In any fuel control system for a gas turbine aeroengine it is necessary to ensure that the probability of a control system component failure causing serious problems in control of the aircraft is extremely remote. This is particularly important in the case of an engine fitted with a FADEC (Full Authority Digital Electronic Control) system, where component failure, if it happens, is more likely to make control of the engine from the aircraft flight station difficult or impossible than was the case with previous types of systems. The most dangerous type of component failure is one which causes a large oversupply of fuel to the engine, leading to a hazardous overspeed of the engine's compressor and turbine. Consequently, it is usual to provide fuel control systems with units (hereinafter referred to for the purposes of this specification as "overspeed limiters") which detect any overspeeds and automatically reduce the supply of fuel to an amount which does not cause the engine to overspeed.
One problem with current types of overspeed limiters is that, by definition, they are not normally in control of the engine and are only activated in an emergency. Consequently, the limiter unit itself may fail unnoticed whilst the unit is dormant, thus making the unit unable to perform its function correctly when activated. Hence the correct functioning of such units must be regularly checked, say as part of the normal flight readiness procedures before each take-off.
A principle object of the present invention is to provide an overspeed limiter which not only protects the engine against being over-fueled but also causes any failure in its own functioning to be immediately apparent, so rendering the regular checks unnecessary.